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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 
established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment 
to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 
special reports prepared as part of our oversight responsibilities to promote economy, 
efficiency, and effectiveness within the department. 

The attached report presents the results of the U.S. Immigration and Customs 
Enforcement's balance sheet audit for fiscal year (FY) 2009. We contracted with the 
independent public accounting firm KPMG LLP (KPMG) to perform the audits. The 
contract required that KPMG perform its audits according to generally accepted 
government auditing standards and guidance from the Office of Management and Budget 
and the Government Accountability Office. KPMG concluded that ICE's consolidated 
balance sheet as of September 30, 2009, is presented fairly, in all material respects, in 
conformity with U.S. generally accepted accounting principles. The FY 2009 auditors' 
report discusses four material weakness, and six significant deficiencies in internal 
control. KPMG is responsible for the attached auditors' report, and the conclusions 
expressed in the report. We do not express opinions on ICE's balance sheet or provide 
conclusions on compliance with laws and regulations. 

The recommendations herein have been discussed in draft with those responsible for 
implementation. We trust this report will result in more effective, efficient, and 
economical operations. We express our appreciation to all of those who contributed to 
the preparation of this report. 




Richard L. Skinner 
Inspector General 



KPMG LLP 

2001 M Street, NW 
Washington, DC 20036 



Independent Auditors' Report 

Director of the U.S. Department of Homeland Security 

U.S. Immigration and Customs Enforcement, and Inspector General, 

U.S. Department of Homeland Security: 

We have audited the accompanying balance sheet of the U.S. Department of Homeland Security 
(DHS) U.S. Immigration and Customs Enforcement (ICE) as of September 30, 2009. The 
objective of our audit was to express an opinion on the fair presentation of the balance sheet. In 
connection with our fiscal year audit, we also considered ICE's internal controls over financial 
reporting, and tested ICE's compliance with certain provisions of applicable laws, regulations, 
contracts, and grant agreements that could have a direct and material effect on the balance sheet. 

Summary 

As stated in our opinion on the balance sheet, the accompanying balance sheet as of September 
30, 2009, is presented fairly, in all material respects, in conformity with U.S. generally accepted 
accounting principles. 

Our consideration of internal control over financial reporting resulted in the following conditions 
being identified as significant deficiencies: 

A. Information Technology General and Application Controls 

B. Duplicate Payments 

C. Office of Detention and Removal Budget Allocations 

D. General Property, Plant, and Equipment 

E. Accounts Payable 

F. Undelivered Orders 

G. Untimely Recording of Obligations 

H. IPAC Transactions 

I. Financial Reporting 

J. Pending/Threatened Litigation Accrual 

We consider significant deficiencies A, B, C and D above, to be material weaknesses. 

The results of our tests of compliance with certain provisions of laws, regulations, contracts, and 
grant agreements disclosed no instances of noncompliance or other matters that are required to be 
reported under Government Auditing Standards, issued by the Comptroller General of the United 
States, and Office of Management and Budget (OMB) Bulletin No. 07-04, Audit Requirements 
for Federal Financial Statements. 

The following sections discuss our opinion on ICE's balance sheet; our consideration of ICE's 
internal controls over financial reporting; our tests of the ICE's compliance with certain 
provisions of applicable laws, regulations, contracts, and grant agreements; and management's 
and our responsibilities. 



KPMG LLP, a U.S. limited liability partnership, is the U.S. 
member firm of KPMG International, a Swiss cooperative. 



Opinion on the Balance Sheet 

We have audited the accompanying balance sheet of the U.S. Immigration and Customs 
Enforcement as of September 30, 2009. 

In our opinion, the balance sheet referred to above presents fairly, in all material respects, the 
financial position of ICE as of September 30, 2009, in conformity with U.S. generally accepted 
accounting principles. 

As discussed in Note 1 to the balance sheet, ICE has not presented the balance sheet and notes 
thereto in full compliance with OMB Circular A-136. The information in the Introduction section 
is not a required part of the balance sheet, but is supplementary information required by U.S. 
generally accepted accounting principles. We have applied certain limited procedures, which 
consisted principally of inquiries of management regarding the methods of measurement and 
presentation of this information. However, we did not audit this information and, accordingly, we 
express no opinion on it. 

Internal Control over Financial Reporting 

Our consideration of the internal control over financial reporting was for the limited purpose 
described in the Responsibilities section of this report and would not necessarily identify all 
deficiencies in the internal control over financial reporting that might be significant deficiencies 
or material weaknesses. 

A control deficiency exists when the design or operation of a control does not allow management 
or employees, in the normal course of performing their assigned functions, to prevent or detect 
misstatements on a timely basis. A significant deficiency is a control deficiency, or combination 
of control deficiencies, that adversely affects the entity's ability to initiate, authorize, record, 
process, or report financial data reliably in accordance with U.S. generally accepted accounting 
principles such that there is more than a remote likelihood that a misstatement of the entity's 
balance sheet that is more than inconsequential will not be prevented or detected by ICE's 
internal control. A material weakness is a significant deficiency, or combination of significant 
deficiencies, that results in more than a remote likelihood that a material misstatement of the 
balance sheet will not be prevented or detected by the entity's internal control. 

In our fiscal year 2009 audit, we consider the deficiencies, described in Exhibits I and II, to be 
significant deficiencies in internal control over financial reporting. However, of the significant 
deficiencies described in Exhibits I and II, we believe that the significant deficiencies presented 
in Exhibit I are material weaknesses. 

Compliance and Other Matters 

The results of our tests of compliance as described in the Responsibilities section of this report, 
disclosed no instances of noncompliance or other matters that are required to be reported herein 
under Government Auditing Standards or OMB Bulletin No. 07-04. 
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Responsibilities 

Management's Responsibilities. Management is responsible for the balance sheet; establishing 
and maintaining effective internal control; and complying with laws, regulations, contracts, and 
grant agreements applicable to ICE. 

Auditors' Responsibilities. Our responsibility is to express an opinion on ICE's balance sheet as 
of September 30, 2009, based on our audit. We conducted our audit in accordance with auditing 
standards generally accepted in the United States of America; the standards applicable to 
financial audits contained in Government Auditing Standards, issued by the Comptroller General 
of the United States; and OMB Bulletin No. 07-04. Those standards and OMB Bulletin No. 07-04 
require that we plan and perform the audit to obtain reasonable assurance about whether the 
balance sheet is free of material misstatement. An audit includes consideration of internal control 
over financial reporting as a basis for designing audit procedures that are appropriate in the 
circumstances, but not for the purpose of expressing an opinion on the effectiveness of ICE's 
internal control over financial reporting. Accordingly, we express no such opinion. 

An audit also includes: 

• Examining, on a test basis, evidence supporting the amounts and disclosures in the notes to 
the balance sheet; 

• Assessing the accounting principles used and significant estimates made by management; and 

• Evaluating the overall balance sheet presentation. 

We believe that our audit provides a reasonable basis for our opinion. 

In planning and performing our audit of ICE's balance sheet as of September 30, 2009, we 
considered ICE's internal control over financial reporting by obtaining an understanding of ICE's 
internal control, determining whether internal controls had been placed in operation, assessing 
control risk, and performing tests of controls as a basis for designing our auditing procedures for 
the purpose of expressing our opinion on the balance sheet. We did not test all internal controls 
relevant to operating objectives as broadly defined by the Federal Managers' Financial Integrity 
Act of 1982. The objective of our audit was not to express an opinion on the effectiveness of 
ICE's internal control over financial reporting. Accordingly, we do not express an opinion on the 
effectiveness of ICE's internal control over financial reporting. 

As part of obtaining reasonable assurance about whether ICE's balance sheet as of September 30, 
2009 is free of material misstatement, we performed tests of ICE's compliance with certain 
provisions of laws, regulations, contracts, and grant agreements, noncompliance with which could 
have a direct and material effect on the determination of the balance sheet amounts, and certain 
provisions of other laws and regulations specified in OMB Bulletin No. 07-04. We limited our 
tests of compliance to the provisions described in the preceding sentence, and we did not test 
compliance with all laws, regulations, contracts, and grant agreements applicable to ICE. 
However, providing an opinion on compliance with laws, regulations, contracts, and grant 
agreements was not an objective of our audit and, accordingly, we do not express such an 
opinion. 



ICE management has indicated in a separate letter immediately following this report that it 
concurs with the findings presented in Exhibits I and II. We did not audit ICE's responses, and 
accordingly, we express no opinion on them. 
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This report is intended solely for the information and use of ICE's management, management of 
DHS, DHS's Office of Inspector General, OMB, the U.S. Government Accountability Office, and 
the U.S. Congress and is not intended to be and should not be used by anyone other than these 
specified parties. 

K^P^(o LCP 

December 18, 2009 



4 



Independent Auditors' Report 
Exhibit I - Material Weaknesses 



I-A Information Technology General and Application Controls 

Background: The U.S. Department of Commerce (DOC) hosts key financial accounting 
applications, which are owned and managed by the U.S. Immigration and Customs Enforcement 
(ICE) agency. Our audit procedures over information technology (IT) general controls for ICE 
included testing of the ICE's General Support System, Active Directory Exchange (ADEX) and 
Federal Financial Management System (FFMS). 

Conditions: We identified 14 new IT findings during our audit. The findings stem from four of 
the five Federal Information System Controls Audit Manual (FISCAM) key control areas and 
Entity Level controls. The FISCAM IT general control deficiencies that present a risk to ICE's 
financial system processes and data integrity are summarized below: 

• Security configuration weaknesses exist over the ICE ADEX network of high and medium 
risk as defined by the ICE Office of the Chief Financial Officer. Detailed vulnerability results 
were provided to ICE management. 

• Lack of effective controls of the availability, integrity, and confidentiality of the FFMS. 
These weaknesses have caused system resources degradation, which resulted in an instance of 
duplicate invoice and other payments of over $13 million being issued during FY 2009. 

• Ineffective/non-compliant account lockout counter settings. 

• Ineffective password settings in FFMS. 

• Failure to enforce IT Security Training Awareness requirements. 

• Ineffective controls to manage recertification over system administrator access to manage 
security software. 

• Excessive access for authorized users of FFMS and segregation of duty violations within 
FFMS. 

• Entity level control weaknesses over IT security training, background investigations for new 
hires, and exit processing for terminated\transferred employees. 

• Ineffective safeguards over physical access to sensitive facilities and resources. 

• Incomplete policies and procedures over equipment and media sanitization. 

Cause/Effect: The growth in ICE demands on system resources and the inability of FFMS to meet 
the current demands have attributed to the IT material weakness. Other causes consist of the lack 
of effective controls over the availability, integrity and confidentiality of FFMS as well as the 
lack of system resources and adequate training. Collectively, the IT control deficiencies limited 
ICE's ability to assert that critical financial and operational data used by management and 
reported in the ICE financial statements is maintained in such a manner to ensure confidentiality, 
integrity, and availability. These deficiencies negatively impacted the internal controls over 
financial reporting and its operations, and we consider them to collectively represent a material 
weakness. 

Criteria: OMB Circular A-130, Management of Federal Information Resources, and various 
NIST guidelines describe specific criteria for maintaining effective general IT controls. OMB 
Circular A- 127 prescribes standards for Federal agencies to follow in developing, operating, 
evaluating, and reporting on financial management systems. DHS' Sensitive Systems Policy 
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Independent Auditors' Report 
Exhibit I - Material Weaknesses 

Directive, 4300A documents policies and procedures adopted by DHS intended to improve the 
security and operation of all DHS IT systems. 

Recommendations: We recommend that ICE: 

1. Complete the agreed-upon corrective actions for its IT findings in FY 2010; 

2. Implement the recommendations in our Limited Official Use (LOU) letter provided to ICE, to 
effectively address the deficiencies identified above and described in greater detail in the 
LOU report; and 

3. Design and implement appropriate corrective action plans that address the root cause of the 
IT control deficiencies at ICE. 



I-B Duplicate Payments 

Background: Invoices are received at the Burlington Finance Center (BFC) and are stamped with 
the date received. BFC enters the information from the invoice into FileonQ, the invoice tracking 
database, and subsequently distributes the invoice to the Contracting Officer Technical 
Representative (COTR) for approval or rejection. The invoices are scanned and sent to the Dallas 
Finance Center (DFC) to process. In order for DFC to make a payment, the invoice must be 
certified for payment; i.e. goods have been received and accepted and services have been 
received. The program offices have 7 days to receive and accept goods. After 7 days constructive 
acceptance occurs. Certification for payment can consist of either manual certification via a 
signature on the invoice or by the creation of a receiving ticket within FFMS. Receiving tickets 
are required for the acceptance of goods. Funds are set aside in FFMS when a receiving ticket is 
created. If the invoice was manually certified, a payment shell (Payment Request Transaction 
Screen) is created within FFMS. 

Conditions: During our interim test work over procurement and subsequent discussions with ICE 
management, we observed that FFMS did not have adequate controls to prevent processing of 
duplicate payments. Specifically, on June 16, 2009, FFMS processed 808 duplicate payments to 
individuals and vendors for ICE and United States Citizenship and Immigration Services (USCIS) 
totaling approximately $13.3 million. ICE subsequently instituted procedures to collect the 
erroneous disbursements from the affected individuals and vendors as of June 30, 2009, and 
substantially all of the duplicate payments were recovered as of September 30, 2009. 

Cause/Effect: Individuals with responsibility for processing payments did not follow established 
policies and procedures for processing or canceling payments. Further, it appears that these 
individuals did not obtain adequate training to fully understand system capabilities. The 
processing of duplicate payments in FFMS may cause misstatement of related balances in the 
financial statements, including fund balance with Treasury, accounts payable, expenses, and 
undelivered and delivered obligations. 

Criteria: The Standards for Internal Control in the Federal Government (Standards) issued by 
the Government Accountability Office states that "Transactions should be promptly recorded to 
maintain their relevance and value to management in controlling operations and making 
decisions. This applies to the entire process or life cycle of a transaction or event from the 
initiation and authorization through its final classification in summary records. In addition, 
control activities help to ensure that all transactions are completely and accurately recorded." 
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Independent Auditors' Report 
Exhibit I - Material Weaknesses 

GAO's Standards for Internal Control in the Federal Government defines internal control as "an 
integral component of an organization's management that provides reasonable assurance that the 
following objectives are being achieved: effectiveness and efficiency of operations, reliability of 
financial reporting, and compliance with applicable laws and regulations." Furthermore, 
Standards for Internal Controls in the Federal Government lists examples of control activities that 
include (1) top-level reviews of actual performance, (2) reviews by management at the functional 
or activity level, (3) management of human capital, (4) controls over information processing (5) 
physical control over vulnerable assets, (6) Establishment and review of performance measures 
and indicators, (7) segregation of duties, (8) proper execution of transactions and events, (9) 
accurate and timely recording of transactions and events, (10) access restrictions to and 
accountability for resources and records, and (11) appropriate documentation of transactions and 
internal control. 

Recommendations: We recommend that ICE management monitor its implementation of the new 
management controls to prevent the processing of duplicate payments. In addition, individuals 
with the responsibility to process payments should continue to receive training around system 
capabilities and should adhere to existing policies and procedures to ensure that all disbursements 
are processed correctly or cancelled timely. 

I-C Office of Detention and Removal Budget Allocations 

Background: The Office of Detention and Removal (DRO) is a division of ICE. DRO is the 
primary enforcement arm within ICE for the identification, apprehension and removal of illegal 
aliens from the United States. During FY2009, ICE DRO determined that its Custody Operations 
program had a potential budget shortfall. In researching the reasons for the potential shortfall, 
DRO determined the following root causes: (1) inaccurate estimates for Custody Operations bed 
costs; (2) misclassification of funds where payments were processed using incorrect program or 
organization codes; (3) insufficient funds control at the lower level units within the organization, 
resulting in missed opportunities to identify overspending at the program level of Custody 
Operations; and (4) lack of standardized budgetary resource management oversight processes. 

ICE management subsequently instituted corrective actions by reclassifying the related costs to 
appropriate funding sources, as well as reprogramming other funding authority after obtaining the 
requisite Congressional approval, for the remaining shortfall. 

Conditions: During our testing procedures over obligations and disbursements, and related 
discussions with ICE management as of September 30, 2009, we confirmed that certain costs and 
related disbursements pertaining to DRO activities were not allocated to the proper funding 
sources, resulting in potential overspending in the affected programs. 

In subsequent testing specifically performed over DRO disbursements at year-end, we determined 
that certain reclassification entries recorded by DRO resulting from its research into the potential 
funding shortfall did not have evidence of proper approvals by any authorizing management 
personnel. We further determined that: 

• 9 out of 20 disbursements selected for testing, totaling approximately $23.1 million, did not 
have obligations recorded in FFMS before the period of service began, and 

• 1 out of 6 reclassification entries recorded by DRO, totaling approximately $3.2 million, from 
Custody Operations Program (COP) to the Transportation and Removal Program (TRP) was 
recorded in error. 
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Independent Auditors' Report 
Exhibit I - Material Weaknesses 

Cause/Effect: There is a (a) lack of adequate supervisory review and monitoring of DRO 
obligations and related costs, to ensure increases in anticipated costs for the year are detected and 
corrected in a timely manner, and (b) lack of policies and procedures requiring properly 
documented approval by authorizing personnel for program fund reclassifications. The lack of 
review and monitoring controls over funds status may result in Anti-deficiency Act violations 
and/or misstatements of the obligations and accounts payable balances on the financial 
statements. 

Criteria: The Standards for Internal Control in the Federal Government (Standards) issued by 
the Government Accountability Office states that "Transactions should be promptly recorded to 
maintain their relevance and value to management in controlling operations and making 
decisions. This applies to the entire process or life cycle of a transaction or event from the 
initiation and authorization through its final classification in summary records. In addition, 
control activities help to ensure that all transactions are completely and accurately recorded." 

OMB Circular No. A-l 1, Preparation, Submission, and Execution of the Budget, states in Section 
145.2 — Requirements for Reporting Anti-deficiency Act Violations, that if you authorize or make 
an obligation exceeding an amount in an allotment or a suballotment (a type of administrative 
subdivision of funds), then you must report a violation of the Anti-deficiency Act per 31 U.S.C. 
1517(a)(2). 

Recommendations: We recommend that ICE management continue to implement and follow the 
remediation activities developed in FY 2009. Specifically, management should also: 

• Develop templates and a process for an integrated DRO-wide spending plan monitoring 
process, including the field office specific spending plans that Field Offices can use to track 
spending. 

• Develop and implement standardized key commitment/ob ligation structure to support the 
efficient and effective management of costs at a detailed level. 

Furthermore, ICE management should implement policies and procedures requiring properly 
documented approvals by authorizing personnel for all fund reclassifications. 

I-D General Property Plant and Equipment (PP&E) 

Background: ICE's mission is to protect the security of the American people and homeland by 
vigilantly enforcing the nation's immigration and customs laws. To enforce these laws, ICE has 
invested heavily in software development to analyze data to allow it to achieve its mission. 

Conditions: ICE had not previously implemented comprehensive policies and procedures to 
properly account for internal use software, and software under development, in accordance with 
the applicable accounting standards. As a result, ICE recorded an adjustment totaling $41 million 
to restate its FY 2008 financial statements during FY 2009 to correct this error. 

Cause/Effect: In FY 2009, ICE obtained a "stand-alone" audit of its September 30, 2009 balance 
sheet. In previous years it was asked to prepare financial statements as part of the DHS 
consolidated financial statement audit. In preparing for the stand-alone audit, ICE performed a 
more rigorous review of its significant financial reporting policies and procedures surrounding 
PP&E. Through this review, ICE identified errors in previously reported financial statement 
PP&E balances. Corrective actions were executed and key internal controls established to 
properly state the account balances for financial statement reporting purposes, and updated 
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Independent Auditors' Report 
Exhibit I - Material Weaknesses 



policies and procedures were issued. ICE recorded a restatement for software under development 
for approximately $41 million effective October 1, 2008. 

Criteria: SFFAS No. 10, Accounting for Internal Use Software, provides requirements for the 
capitalization and reporting of internal use software development costs. Per paragraph 16, the 
capitalizable cost "should include the full cost (direct and indirect) incurred during the software 
development stage." Per SFFAS No. 10, paragraphs 18-20, "For COTS [Commercial off-the- 
shelf] software, capitalized cost should include the amount paid to the vendor for the software. 
For contractor-developed software, capitalized cost should include the amount paid to a 
contractor to design, program, install, and implement the software. Material internal cost incurred 
by the federal entity to implement the COTS or contractor-developed software and otherwise 
make it ready for use should be capitalized... Costs incurred after final acceptance testing has 
been successfully completed should be expensed." 

Recommendations: ICE should continue to adhere to its newly developed policies and procedures 
to properly account for and report internal use software balances consistent with applicable 
accounting standards. 
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Independent Auditors' Report 
Exhibit II - Significant Deficiencies 

II-E Accounts Payable 

Background: Accounts payable (A/P) represents amounts owed to others for goods and services 
received, but not yet paid. All transactions (both obligations and disbursements) are recorded 
in the Federal Financial Management System (FFMS). Currently, the trigger to record an accrual, 
at the transaction level in FFMS, is a receiving ticket; however, receiving tickets are only 
required for the receipt of goods, and FFMS users are not required to create a receiving ticket for 
services, although ICE programs do execute receiving tickets (like FPS and DRO). However, 
when payment transactions are posted to FFMS without benefit of a receiving ticket, an A/P 
record is also created. 

Invoices are received at ICE OFM and are stamped with the date received. OFM enters the 
information from the invoice into FileonQ, the invoice tracking database and subsequently makes 
the record available to the COTR for approval or rejection. Upon approval, the invoice record is 
then available for payment processing by OFM. In order for OFM to make a payment, the invoice 
must be certified for payment; i.e. goods have been received and accepted and services have been 
received. The program offices have 7 days to receive and accept the goods. After 7 days, 
constructive acceptance occurs. Certification for payment can consist of either manual 
certification or by the creation of a receiving ticket within FFMS. Receiving tickets are required 
for the acceptance of goods. Although not required for services, many ICE programs use FFMS 
receiving function for this purpose (for example, FPS and DRO). Funds are accrued in FFMS 
when a receiving ticket is created or payment action is processed. If the invoice was manually 
certified, an A/P record (Payment Request Transaction Screen) is created within FFMS. 

Conditions: During our testing procedures over accounts payable transactions for the fiscal year 
which ended September 30, 2009, we observed the following instances where costs incurred were 
not recorded timely into FFMS: 

• 1 out of 54 accounts payable transactions, totaling approximately $2.6 thousand, for the April 
30, 2009 testing period, 

• 63 out of 237 accounts payable transactions, totaling approximately $20.3 million, for the 
July 3 1 , 2009 testing period, and 

• 17 out of 94 accounts payable transactions, totaling approximately $8.6 million, for the 
September 30, 2009 testing period. 

Cause/Effect: Individuals with responsibility for recording A/P in FFMS are not adhering to 
policies and procedures related to the timely recording of A/P in FFMS upon the receipt of an 
invoice and the acknowledgement of the receipt of goods. The inability to timely record liabilities 
increases the risk of a material misstatement of related balances in the financial statements, 
including accounts payable, expenses, undelivered and delivered obligations. 

Criteria: The Standards for Internal Control in the Federal Government (Standards) issued by 
the Government Accountability Office states that "Transactions should be promptly recorded to 
maintain their relevance and value to management in controlling operations and making 
decisions. This applies to the entire process or life cycle of a transaction or event from the 
initiation and authorization through its final classification in summary records. In addition, 
control activities help to ensure that all transactions are completely and accurately recorded." 
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Recommendations: We recommend that ICE program offices and the Office of Financial 
Management implement additional controls to ensure that all AP transactions are entered into 
FFMS timely based on the receipt of invoices for goods and services by the agency. 

II-F Undelivered Orders 

Background: Undelivered Orders (UDOs) - Unpaid are defined as obligations for goods and 
services ordered but not yet delivered. Aged UDOs are defined as obligations having no activity, 
such as modifications, deliveries or payments against an obligation for a grant, agreement, 
contract/purchase order, et cetera for a period of one year or more. 

The Burlington Finance Center (BFC) certifies the UDO balance each quarter as part of the 
Validation and Verification (V&V) reviewing process. The V&V review process over UDOs 
assists in substantiating the ICE UDO balance through a detailed transactional review of 
supporting documentation. V&V also provides support for management's assurance as to the 
overall adequacy and effectiveness of internal controls over UDO balances in accordance with the 
Federal Managers' Financial Integrity Act (FMFIA) and Office of Management and Budget 
(OMB) Circular A- 123, Management 's Responsibility for Internal Control. 

Conditions: During our testing procedures over aged undelivered order balances as of April 30, 
2009, we noted the following: 

• 12 out of 20 UDOs sampled, totaling approximately $24.4 million with no activity within the 
previous 12 months, should have been de-obligated as of April 30, 2009, and 

• 3 out of 20 UDOs sampled, totaling approximately $0.9 million, had abnormal debit balances 
as of April 30, 2009. 

Cause/Effect: ICE field personnel are not adequately following the V&V policies and procedures 
for detecting and correcting inactive UDO balances in a timely manner. In addition, ICE is not 
adequately enforcing policies and procedures currently in place to timely review and correct 
abnormal UDO balances recorded in FFMS. The inability to timely de-obligate inactive UDO 
balances will overstate UDO balances, and simultaneously make them unavailable for other 
purposes. 

Criteria: The Standards for Internal Control in the Federal Government (Standards) issued by 
the Government Accountability Office states that "Transactions should be promptly recorded to 
maintain their relevance and value to management in controlling operations and making 
decisions. This applies to the entire process or life cycle of a transaction or event from the 
initiation and authorization through its final classification in summary records. In addition, 
control activities help to ensure that all transactions are completely and accurately recorded." 

Recommendations: We recommend ICE (a) ensure field personnel are adequately following the 
V&V review policies and procedures, including procedures to ensure invalid UDOs are de- 
obligated in a timely manner, and (b) monitor and enforce the policies and procedures in place to 
timely review and correct abnormal UDO balances recorded in FFMS. 
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II-G Untimely Recording of Obligations 

Background: Office of Acquisition Management - When an office acquires a good or purchases a 
service through the Federal acquisition process governed by the Federal Acquisition Regulation 
(FAR), it must follow a series of procurement actions before the agency obligates funds for that 
purpose. An approving official and a budget official in the program office must approve all 
requests. Once the budget official certifies the funds and the approving official approves the 
request, he/she forwards the request to Office of Acquisition Management (OAQ). In the case of 
Federal Protective Service (FPS) contracts, the request is sent to the servicing Consolidated 
Contracting Group (CCG). The contracting official confirms the signatures of the approving 
officials, completes the acquisition process, and awards a procurement action using the Purchase 
Request Information System (PRISM), ICE's procurement management system. The warranted 
contracting officer signs the hardcopy award document from PRISM. 

Upon the execution of the contract, as evidenced by the contracting officer's approval on the 
award document obligating the agency in an agreement with another government agency or 
commercial vendor, the obligating document is forwarded to OAQ to record the obligation in 
FFMS. Currently, PRISM does not interface with FFMS. Thus, the contracting officers must send 
an electronic copy (via email) and hand deliver the original obligating documents to the 
Obligations Team within OAQ. Upon receiving the obligating documents, the Obligations Team 
is required to ensure the award document in PRISM matches the financial obligation in FFMS 
and manually record the obligating document into FFMS in a timely matter. If the documentation 
does not match, the OAQ Obligations Team returns the award document to the contracting officer 
who works with the program office staff to resolve the issue and ensure the financial obligation 
documentation matches the award document in PRISM. 

Federal Protective Service, Consolidated Contracting Groups - Upon the execution of a FPS 
contract, as evidenced by the contracting officer's approval on the award document obligating the 
agency in an agreement with another government agency or commercial vendor, the obligating 
document is forwarded by the servicing FPS CCG to the Budget Officer or Analyst at the 
requesting FPS Region to record the obligation in FFMS. 

Program Offices - There are also "non-procurement" transactions, which do not require the 
authorization of a contracting officer with warrant authority (e.g., Federal purchase card 
obligations and travel authorizations). These "non-procurement" transactions are created in field 
and/or program offices, where they are funded and approved by funding officials and approval 
officials within their respective offices. Therefore, once these "non-procurement" transactions are 
approved and ready to be obligated for payment, the program offices are responsible for 
recording any related obligations within FFMS. 

Generally, an authorized obligating document should be recorded in the general ledger prior to 
the period of performance per the obligating document. This serves to facilitate timely payments 
against that obligation (e.g., contract, purchase order, travel authorization), which can help limit 
interest for late payments. Further, an authorized obligating document should be recorded in the 
general ledger in its entirety. The complete recording of an obligation in FFMS ensures that the 
entity does not obligate more funds than appropriated and timely payment is made to vendors 
upon receipt of invoices. 

The Burlington and Dallas Finance Centers (BFC and DFC) serve as the disbursement offices for 
ICE; therefore, all invoices are forwarded to the finance centers for payment. In order for BFC 
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and DFC to make a payment, there must be an obligation recorded in the FFMS with sufficient 
funding remaining on the obligation. 

Conditions: During our FY 2009 testing of obligations, we determined that the following 
obligations were not recorded timely in FFMS after being properly approved: 

• 1 out of 41 instances of FPS obligations totaling approximately $40.8 thousand, for the April 
30, 2009 testing period 

• 6 out of 234 instances of FPS obligations totaling approximately $3.5 million, for the July 31, 
2009 testing period 

• 2 out of 234 instances of non-FPS obligations totaling approximately $2.5 million, for the 
July 31, 2009 testing period 

• 1 out of 149 instances of FPS obligations totaling approximately $10 thousand, for the 
September 30, 2009 testing period, and 

• 1 out of 149 instances of non-FPS obligations totaling approximately $60 thousand, for the 
September 30, 2009 testing period. 

We also noted 1 out of 149 instances where a non-FPS obligation totaling approximately $1.1 
million was recorded into FFMS prior to proper approval, for the September 30, 2009 testing 
period. 

Cause/Effect: The untimely recording of obligations in FFMS were caused by (a) individuals with 
responsibility for recording obligations in FFMS not adhering to existing policies and procedures 
related to the recording of obligations in FFMS upon execution of an obligating document; (b) the 
ICE Office of Acquisition Management (OAQ) not providing Interagency Agreements (IAAs) 
and contract documents to the obligations team in a timely manner; and (c) the unauthorized 
obligations being recorded into FFMS prior to being properly authorized was caused by 
inadequate supervisory review of obligations, including controls over the recording of obligations 
into FFMS. These may result in misstatements to the related obligation balances. 

Criteria: The Standards for Internal Control in the Federal Government (Standards) issued by 
the Government Accountability Office states that "Transactions should be promptly recorded to 
maintain their relevance and value to management in controlling operations and making 
decisions. This applies to the entire process or life cycle of a transaction or event from the 
initiation and authorization through its final classification in summary records. In addition, 
control activities help to ensure that all transactions are completely and accurately recorded." 

Recommendations: We recommend that ICE reiterate the need for program offices and the Office 
of Acquisition Management to adhere to the existing policies and procedures, including the need 
for OCM to start providing IAAs and/or contract documents to the obligations team in a timely 
manner, to ensure that obligations are entered into FFMS timely. Furthermore, obligations should 
not be recorded into FFMS before properly authorized supporting documentation. We also 
recommend that ICE implement policies and procedures to ensure that existing policies and 
procedures are being followed. 

II-H IPAC Transactions 

Background: The Intra- Governmental Payment and Collection (IPAC) System is a major 
component of the Government On-Line Accounting Link System II (GOALS II). The IPAC 
application's primary purpose is to provide an automated, standardized, interagency funds 
expenditure transfer mechanism for Federal agencies. It facilitates intragovernmental Federal e- 
commerce by transferring funds, with related descriptive data, from one Federal agency to 
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another on a real-time basis. The IP AC System enables Federal agencies to exchange accounting 
information and to transfer funds between Federal agencies involved in buyer-seller relationships. 
It establishes standardized interagency payment, collection, and adjustment procedures through 
an Internet-based application. 

When the transaction is processed through the IPAC System, immediate collection or payment is 
accomplished. For payment transactions, the IPAC System credits the originating agency's 
Agency Location Code (ALC) and charges the customer agency's ALC. For collection 
transactions, the IPAC System charges the originating agency's ALC and credits the customer 
agency's ALC. The transaction includes all IPAC required fields, as well as all agency-specific 
required data, as stipulated by the customer agency or the trading partner agreement (TP A). 

As the financial service provider, ICE processes the disbursement transactions, including IPAC 
payments, for all of their customers, including Science and Technology (S&T), Departmental 
Management Operations (MGT) and National Preparedness and Protection Directorate (NPPD). 
These disbursements are processed by BFC and DFC. On a daily basis, the IPAC transactions are 
downloaded from GOALS and loaded into an Access database known as the IPAC Management 
System (IMS). The IPAC Management System is used to track and monitor the status of IPACs. 
These transactions are maintained in IMS until each can be sufficiently researched and properly 
posted in FFMS by a payment technician at the BFC or DFC. Currently S&T is the only 
component that requires a receipt and acceptance of all its IPAC transactions, prior to posting to 
the general ledger. For all other components, including ICE, MGT, and NPPD, IPAC transactions 
are posted to an obligation in FFMS when the payment technician identifies a valid obligation 
with adequate funding. 

Conditions: Procedures to verify the receipt and acceptance of goods or services for 
disbursements processed through the IPAC system do not exist for all components serviced by 
BFC and DFC. 

Additionally, during test work over disbursement transaction in FY 2009, we determined that 
many IPAC documents (across all components) did not contain adequate background information 
to determine if the related disbursement was completely and accurately posted against the 
appropriate obligation. Specifically, the IPAC documents were not consistently disclosing 
relevant general ledger posting information such as: 1) the obligation number, 2) the billing 
period of service, and 3) the purpose/description of the services. This condition is applicable not 
only to ICE transactions, but also the transactions of bureaus for which ICE provides accounting 
services: S&T, NPPD, and MGT. 

In subsequent testing performed specifically over IPAC disbursements at fiscal year-end, we 
determined that 3 out of 65 "Direct Pay" IPAC disbursements, totaling approximately $5.5 
million, lacked obligating documents to support the transactions. These IPAC disbursements were 
processed prior to an obligation being set up in FFMS. The disbursements were later reversed and 
posted to the correct obligations after the obligations were created; however, the obligations were 
not created timely. 

Cause/Effect: Policies and procedures have not been fully developed and implemented for 'pre' 
or 'post' validation of IPAC transactions for ICE-servicing components, other than USCIS and 
S&T. The inability to obtain relevant documentation or pertinent information underlying IPAC 
transactions, presents an increased risk of recording disbursements against incorrect obligations. 
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If disbursements are not recorded against the correct obligation, that increases the risk of 
misclassification of program funds. 

Criteria: The Standards for Internal Control in the Federal Government (Standards) issued by 
the Government Accountability Office states that "Transactions should be promptly recorded to 
maintain their relevance and value to management in controlling operations and making 
decisions. This applies to the entire process or life cycle of a transaction or event from the 
initiation and authorization through its final classification in summary records. In addition, 
control activities help to ensure that all transactions are completely and accurately recorded." 

Recommendations: We recommend that the Dallas Finance Center adhere to its existing Standard 
Operating Procedures for IP AC transactions. We also recommend that the Office of Financial 
Management (a) examine current policies and procedures and enhance them to include timely 
'post' validation when disbursements are processed through the IPAC system. The procedures 
should clearly delineate the responsibilities of the BFC, DFC, and ICE's program offices; (b) 
develop and implement controls to monitor the execution of policies and procedures related to 
IPAC transactions, to ensure that they are being followed, and (c) develop standards, in addition 
to the basic data field requirements for IPAC documents, that require customer agencies to 
include pertinent transaction information (e.g., obligation number, service period, point(s) of 
contact, and description of services) necessary for timely, accurate posting of disbursements 
against obligations and proper transaction validation. 

II-I Financial Reporting 

Background: DHS - Treasury Information Executive Repository (DHSTIER) was developed by 
the Department of Treasury to be United States Standard General Ledger (USSGL) compliant and 
is located within TreasNet, a Treasury-wide firewall protected computer network. DHSTIER is 
part of the CFO Financial Reporting System for DHS. The CFO Financial Reporting System 
captures, validates, analyzes, and reports financial and budgetary data. In addition, it is the central 
repository for the DHS key financial management information. It stores financial data, generates 
performance reports, and tracks Department and Bureau level responses to audit 
recommendations. 

DHS TIER Reports 

During the TIER submission process, a number of reports are generated to identify, analyze and 
resolve financial reporting discrepancies to enhance the integrity of the financial reporting 
process and data. These standard reports are generated after each TIER submission. They include: 
the Abnormal Balance Report, Analytical Report and the Eliminations (intra-DHS) Report. 

Analytical Reports 

The report is generated during the submission of the TIER data and is reviewed monthly by an 
ICE OFM Accounting Specialist. The report identifies certain account relationships that violate 
the USSGL test. These relationships affect both budgetary and proprietary accounts that should 
net to zero in order to pass the USSGL test. For instance, proprietary account Accounts Payable 
should net against the budgetary account Delivered orders Obligations Unpaid. This relationship 
suggests that the goods were delivered, but have not been paid for; thus, validating the payable. A 
difference between these two accounts could be indicative of a data entry error. The error could 
be caused by an improper T-Code or an improper manual entry. The complexity of the 
relationship determines the amount of time it may take to resolve. These analytical differences do 
not interfere with the TIER submission process. The differences are identified as warnings, as 
opposed to errors. Although the differences are considered warnings, all differences over the 
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materiality threshold established by the Department for ICE should be cleared prior to the 
monthly final TIER submission. If differences over the materiality threshold can not be properly 
cleared prior to final submission, they must be explained and reported as an exception on the 
CFO Certification. 

Conditions: During test work performed over the Budgetary to Proprietary relationships as of 
September 30, 2009, we identified abnormal balances for USSGL account 6100 in Fund symbol 
70X0545. After further investigation, it was determined that the agency modified its process for 
recording and tracking property, plant and equipment. Based on the changes in policy, the agency 
now captures all capitalization activity in 70X0545. As a result, the current year capitalization 
costs recorded in 70X0545 are attributed to expenses incurred in other federal account symbols. 
This results in higher offset amounts than what was originally recorded as expenses in 70X0545. 
The capitalization amounts are posted on a summary level to 70X0545 and can not be tracked 
back to individual transactions. 

Cause/Effect: ICE has modified their process for recording and tracking property, plant and 
equipment to ensure that capitalization cost is properly recorded in FFMS amongst other 
objectives. However, ICE does not currently have the resources to track capitalization cost on a 
transaction level. Failure to track capitalization cost on a transaction level could cause ICE to be 
non-compliant with Section 803(a) of FFMIA and OMB Circular number A-127. In addition the 
current policy for tracking property, plant and equipment impacts the true presentation of 
financial data. 

Criteria: Section 803(a) of FFMIA requires that Federal financial management systems comply 
with (1) Federal accounting standards, (2) Federal system requirements, and (3) the United States 
Government Standard General Ledger at the transaction level. FFMIA emphasizes the need for 
agencies to have systems that can generate timely, reliable, and useful information with which to 
make informed decisions to ensure ongoing accountability. 

In addition, OMB Circular number A-127 Policies and Standards for Financial Management 
Systems, and OMB Circular number A- 130, Appendix III, Security of Federal Automated 
Information Resources require application of the U.S. Government Standard General Ledger at 
the transaction level. It states that financial events shall be recorded by agencies throughout the 
financial management system by applying the requirements of the USSGL at the transaction 
level. Application of the USSGL at the transaction level means that the financial management 
systems will process transactions following the definitions and defined uses of the general ledger 
accounts as described for the USSGL. Also, compliance with the standard requires that 
supporting transaction details for USSGL accounts be readily available. That is, transaction detail 
supporting USSGL accounts shall be available in the financial management systems and directly 
traceable to specific USSGL account codes. Section 7 of OMB Circular No. A-127 further states 
the design of the financial management systems shall reflect an agency-wide financial 
information classification structure that is consistent with the U. S. Government Standard General 
Ledger, provides for tracking of specific program expenditures, and covers financial and 
financially related information. This structure will minimize data redundancy, ensure that 
consistent information is collected for similar transactions throughout the agency, encourage 
consistent formats for entering data directly into the financial management systems, and ensure 
that consistent information is readily available and provided to internal managers at all levels 
within the organization. Financial management system designs shall support agency budget, 
accounting and financial management reporting processes by providing consistent information for 
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budget formulation, budget execution, programmatic and financial management, performance 
measurement and financial statement preparation. 

Recommendations: We recommend that ICE updates its policies and procedures over the tracking 
of property, plant and equipment to allow tracking on a transaction level either with the use of 
USSGL Account 5720 {Financing Sources Transferred In Without Reimbursement) and USSGL 
Account 5730 {Financing Sources Transferred Out Without Reimbursement) or another method 
that is compliant with the USSGL. 

II-J Pending/Threatened Litigation Accrual 

Background: The DHS Office of the Chief Financial Officer (OCFO) and the Office of General 
Counsel (OGC) have used a centralized approach to evaluating DHS's contingent legal liabilities 
for purposes of recording an accrued liability at September 30, 2009 and drafting appropriate note 
disclosures. Component information is provided to the OCFO and compiled from the respective 
entities' OGC representatives. 

To perform our evaluation of internal controls over the process, and assess the reasonableness of 
management's estimated legal liabilities and disclosures in the September 30, 2009 financial 
statements, KPMG requested an interim legal letter from the DHS-OGC, representing the status 
of unasserted and asserted legal claims as of June 30, 2009, and a final update as of September 
30, 2009. Those claims pending against DHS are presented on a management schedule detailing 
the claims by component, and showing the claim amount, likelihood of loss, and range of 
potential loss. 

Condition: Comparison of the June 30, 2009 interim legal management schedule to the 
September 30, 2009 final legal management schedule shows that ICE added 22 cases. We 
inquired of the OGC whether each of these 22 cases represents new claims against ICE, or if they 
were not new cases and should have been included on the June 30, 2009 interim management 
schedule. The OGC confirmed that 6 cases were inadvertently left off of the June 30, 2009 
Management Schedule. 

Cause/Effect: Errors in the preparation of the interim legal management schedule and related 
legal templates were caused by a lack of effective internal controls over the legal liability 
assessment and compilation process. Failure to include the 6 claims on the June 30, 2009 interim 
legal management schedule resulted in an incomplete assessment of the nature and amount of 
pending / threatened litigation against ICE, and DHS as a whole, in the interim financial 
statement as of June 30, 2009. 

Criteria: Statement of Federal Financial Accounting Standard (SFFAS) No. 5, Accounting for 
Liabilities of the Federal Government, as amended, states that a contingent liability should be 
recognized when all of these three conditions are met: 

1) A past event or exchange transaction has occurred. 

2) A future outflow or other sacrifice of resources is probable. 

3) The future outflow or sacrifice of resources is measurable. 

The estimated liability may be a specific amount or range of amounts... If no amount within a 
range is a better estimate than any other amount, the minimum amount in the range is recognized 
and the range and a description of the nature of the contingency should be disclosed. 
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Further, SFFAS No. 5, paragraph 33, defines "probable" as future confirming event/events being 
more likely than not to occur. 

The Government Accountability Office's Standards for Internal Control in the Federal 
Government states that management is responsible for developing control activities, which are the 
policies, procedures, techniques and mechanisms that enforce management's directives. Control 
activities occur at all levels and functions of an entity and include a wide range of activities, such 
as verifications and maintenance of related records which provide evidence of execution of these 
activities, as well as appropriate documentation. 

Recommendations: We recommend that the ICE Office of Financial Management in conjunction 
with the Office of the General Counsel: 

1. Conduct a comprehensive review of the processes to prepare, record and disclose the 
legal liability balance for inclusion in the DHS consolidated financial statements, 

2. Make appropriate changes to systems and processes/sub-processes methodologies, to 
include the design and implementation of internal controls, to mitigate the 
risks/conditions identified, and 

3. Test the controls to determine that they are designed properly and operating effectively. 
See attached ICE Management's response to the report on the following page. 
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MEMORANDUM FOR: 



Inspector General 

Departmental of Homeland Security 




FROM: 



Radha C. Sekarl 
Chief Financial Officer 
U.S. Immigration and Customs Enforcement 



SUBJECT: 



Management Response to Independent Auditor's 
Report on U.S. Immigration and Customs Enforcement's 
Fiscal Year 2009 Consolidated Balance Sheet 



On behalf of U.S. Immigration and Customs Enforcement (ICE), I am responding to the Independent 
Auditor's Report on ICE's Fiscal Year (FY) 2009 Consolidated Balance Sheet. 

I accept the independent public accounting firm. K.PMG LLP's, unqualified opinion on ICE's FY 2009 
Consolidated Balance Sheet, which concluded that ICE's consolidated balance sheet is fairly presented in 
all material respects in conformity with accounting principles. 

ICE has reviewed and concurs with the four material weaknesses as well as the six significant 
deficiencies. Mission Action Plans (MAPs) outlining ICE strategy to correct these conditions will be 
prepared and provided to the DHS Office of Financial Management. ICE will continue to work to resolve 
all auditor identified weakness. 

ICE appreciates the opportunity to review this year's audit report and looks forward to continuing our 
professional auditing relationship with your office. If you have any questions or would like additional 
information, please contact me at (202) 732-3075, or a member of your staff may contact Kathy A. Hill, 
Director, Office of Assurance and Compliance at (202) 732-6356. 

Radha C. Sekar 



Attachment 



www.ice.gov 
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